data_perimeter_governance_policy_2.json

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid":"PreventLambdaFunctionURLAuthNone",
         "Effect":"Deny",
         "Action":[
            "lambda:AddPermission",
            "lambda:UpdateFunctionU*",
            "lambda:CreateFunctionU*"
         ],
         "Resource":"*",
         "Condition":{
            "StringNotEqualsIfExists":{
               "aws:PrincipalTag/dp:exclude:identity": "true"
            },
            "StringEquals": {
               "lambda:FunctionUrlAuthType" : "NONE"
            }
         }
      },
      {
         "Sid": "PreventIdPTrustModifications",
         "Effect": "Deny",
         "Action": [
           "iam:CreateOpenIDConnectProvider",
           "iam:DeleteOpenIDConnectProvider",
           "iam:AddClientIDToOpenIDConnectProvider",
           "iam:RemoveClientIDFromOpenIDConnectProvider",
           "iam:TagOpenIDConnectProvider",
           "iam:UntagOpenIDConnectProvider",
           "iam:UpdateOpenIDConnectProviderThumbprint",
           "iam:CreateSAMLProvider",
           "iam:DeleteSAMLProvider",
           "iam:TagSAMLProvider",
           "iam:UntagSAMLProvider",
           "iam:UpdateSAMLProvider",
           "rolesanywhere:CreateTrustAnchor",
           "rolesanywhere:DeleteTrustAnchor",
           "rolesanywhere:EnableTrustAnchor",
           "rolesanywhere:DisableTrustAnchor",
           "rolesanywhere:UpdateTrustAnchor",
           "rolesanywhere:EnableCrl",
           "rolesanywhere:DeleteCrl",
           "rolesanywhere:DisableCrl",
           "rolesanywhere:ImportCrl",
           "rolesanywhere:UpdateCrl",
           "rolesanywhere:TagResource",
           "rolesanywhere:UntagResource",
           "sso:CreateInstance"
         ],
         "Resource": "*",
         "Condition": {
           "StringNotEqualsIfExists": {
             "aws:PrincipalTag/dp:exclude:identity": "true"
           }
         }
      },
      {
         "Sid": "PreventDeploymentCodeStarConnections",
         "Effect": "Deny",
         "Action": [
            "codestar-connections:*"
         ],
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude": "true"
            }
         }
      },
      {
         "Sid":"PreventNonVPCDeploymentSageMaker",
         "Effect":"Deny",
         "Action":[
            "sagemaker:CreateHyperParameterTuningJob",
            "sagemaker:CreateModel",
            "sagemaker:CreateNotebookInstance",
            "sagemaker:CreateTrainingJob"
         ],
         "Resource":"*",
         "Condition":{
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude": "true"
            },
            "Null":{
               "sagemaker:VpcSubnets":"true"
            }
         }
      },
      {
         "Sid":"PreventNonVPCDeploymentLambda",
         "Effect":"Deny",
         "Action":[
            "lambda:CreateFunction",
            "lambda:UpdateFunctionConfiguration"
         ],
         "Resource":"*",
         "Condition":{
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude": "true"
            },
            "Null":{
               "lambda:VpcIds":"true"
            }
         }
      },
      {
         "Sid":"PreventNonVPCDeploymentGlueJob",
         "Effect": "Deny",
         "Action": [
            "glue:CreateJob",
            "glue:UpdateJob"
         ],
         "Resource": "*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude": "true"
            },
            "Null": {
               "glue:VpcIds": "true"
            }
         }
      },
      {
         "Sid": "PreventNonVPCDeploymentCloudShell",
         "Action": [
            "cloudshell:CreateEnvironment"
         ],
         "Effect": "Deny",
         "Resource": "*",
         "Condition": {   
            "StringNotEqualsIfExists": {
               "aws:PrincipalTag/dp:exclude": "true"
            },
            "Null": {
               "cloudshell:VpcIds": "true"
            }
         }
      }
   ]
}